Treasury
A Proposed Module PRD and Specification

This is a proposal, in the same posture as PP v0.3 and inheriting the same humility: the language of specification below serves discussion, and every should can be argued down. PRD v0.4 carved treasury execution, distributions and multi-signature authorization, out of the launch capabilities and left it for later under a name not yet settled.² PP v0.3 honored that carve-out by drawing a boundary: the patronage module records value and allocation as events and writes distribution commitments with settlement anticipated, and it never moves money.¹ This document proposes the module on the other side of that line.

Its scope is wider than distributions alone, because the boundary PP drew implies a whole layer. Money enters the cooperative at the front door, share purchases, dues, program payments; it rests in custody at the bank; it leaves as distributions and, one day, redemptions; and the books must close over all of it. The rails for each of these are already connected, per the Financial Systems Committee's February work now realized: Mercury as primary banking, Stripe migrated under the LCA's own name, Xero as the book of account.⁴ None is merged with the CIS. This module is the proposed shape of that merge: not a general ledger, not a payment processor, but the governance record of every movement the cooperative's own rules care about, built from the same Ground, verbs, and disciplines as everything else, with no change to the event log model.

Law X holds here with special force, since this is the module nearest to money: the instrument drafts, computes, and surfaces; proposing, approving, and executing movements are human acts, every one. Nou holds no role, no grant, and no key, and nothing below would change that.⁵

The treasury needs surprisingly little that does not already exist. The events table carries the two instants, the human actor, the book partition, the payload, the corrects reference, and the settlement axis whose values, settled, anticipated, open, were built for exactly the distinction this module lives on.³ The role_grants table already knows the treasurer, grounded in Bylaws §4.4, alongside the steward and the directors.⁴ The stock_ledger already models issuance and redemption, and enforces one voting share per member as a partial unique index; the membership lifecycle already admits the transition from withdrawn or terminated to redeemed.³ The agreements table stands ready to hold treasury policy as a versioned instrument, exactly as it holds patronage policy in PP §7. The export views already include the events log, so every kind this module would write inherits the walkaway with no amendment.³

And the seam pattern is already deployed and proven: the notices rail of 0006 shows how an external service joins the Ground honestly, a trigger that carries no secret, an edge function doing privileged work under its own credentials with the reference-not-value rule, and one seam so the provider can swap without the record changing.³ The Stripe intake proposed in §7 is that pattern pointed inward at money instead of outward at mail. What the Ground does not hold, this proposal declares rather than migrates: the movement kinds (§5), the treasury policy instrument (§6), and the verbs (§7, §10 by reference). The schema is untouched.

From PP v0.3 this proposal inherits Valued Event, Tally, Allocation Run, and the Plan's capitalized terms unchanged. It adds: a Movement is money entering, resting, or leaving the cooperative's custody. A Governed Movement is a Movement one of the cooperative's instruments has an opinion about, and only those are recorded here. A Commitment is a recorded obligation to move money, PP's capital.distribution rows being the first citizens. The Pairing is the relationship between a Commitment and the Movement that discharges it, and, one level down, between a Movement's CIS record and its bank line and journal entry. A Reconciliation Window is the period over which pairings are attested. The Desk is the treasurer's surface where all of this is visible and workable.

The deepest design choice in this proposal is a separation the fabric already implied: treasury records movement; patronage records meaning; neither substitutes for the other, and the pairing of the two is the trustworthy fact. A member's cash capital contribution is two events in two layers: money.received, the treasury fact that dollars arrived with a bank or processor reference, and capital.contribution under the CASH Primitive, the patronage fact that a capital account was credited under a policy version, each carrying the other's id in its payload. A share purchase is a movement plus an issuance plus a buy-in credit. A distribution is a PP commitment plus a treasury execution. The layers can disagree, and that possibility is a feature: a movement with no meaning, or a meaning with no movement, is exactly what the reconciliation tally exists to surface.

The same principle answers how commitments settle without violating Law I. PP writes capital.distribution with settlement anticipated, and that authored mark never mutates. Settlement is achieved by pairing: a disbursement.executed event referencing the commitment, confirmed by a reconciliation match. Surfaces derive the settled state from the pair; the commitment row remains, honestly, what it was when written. Nothing flips; something arrives beside it.

The module would write these kinds and no others. Movement kinds carry the rail reference that makes them checkable; authorization kinds carry the trail that makes them governed:

Columns do their standing work: actor_agent_id is the human whose act this was, agent_id the member a movement concerns where one does, book the entity or host partition per Law IX, so a grant-funded program's money facts ride the host book while member capital stays entity-side, exactly as PP pinned it. The payloads:

-- proposed payload contract · money.received
{
  "purpose":            "share_purchase" | "dues" | "capital_contribution" | "program_payment",
  "amount":             numeric,
  "rail":               "stripe" | "mercury" | "manual",
  "rail_ref":           text,    -- payment intent, transaction id; the idempotency key, verb-checked
  "meaning_event_id":   uuid?,   -- the PP-layer event, once posted; the pairing, movement side
  "instrument_id":      uuid?    -- the terms it priced from: membership terms, dues schedule
}

-- proposed payload contract · disbursement.executed
{
  "proposal_event_id":  uuid,
  "approvals":          [uuid],  -- the approval events, distinct actors, threshold per policy
  "commitment_event_id":uuid?,   -- PP's capital.distribution where one is discharged
  "bank_ref":           text,
  "xero_ref":           text?    -- the journal, once posted; completes the three-way pairing
}

Authorization is configuration, and configuration is record, in exactly PP §7's convention: a TREASURY-POLICY instrument, versioned and effective-dated, whose adoption payload carries the thresholds, who may propose, how many distinct approvals each band of amount requires, which purposes are pre-authorized as standing (dues refunds under a limit, say) and which always stop for a board act. No threshold appears in code; the verbs read the version in force, and a change is an amendment event, prospective only. The floor this proposal suggests as the default: no disbursement on fewer than two distinct human acts, proposer and approver never the same person, with higher bands adding approvals and the highest requiring a recorded board resolution. The refusal verb exists so that declining is as recorded as approving.

Stripe, the front door. The intake follows the deployed 0006 pattern: the webhook lands at an edge function holding its own credentials, the function calls one definer verb, and the verb writes money.received with the processor reference as its idempotency key, checked before insert so a replayed webhook writes nothing twice. Purpose and pricing come from the instrument in force, membership terms for the share purchase, the dues schedule for dues, so the front door cannot invent an amount. For a share purchase the same verb sequence issues the stock_ledger row and prompts, rather than posts, the PP-layer buy-in credit: the meaning event is a human act on the desk, in keeping with the two-layer principle and with capability 04's read-only-first posture.

Mercury, custody and execution. Inbound bank facts arrive by transaction feed into the reconciliation input. Outbound, this proposal takes a deliberately conservative posture for v0.1: the system prepares the disbursement completely, the trail, the payee, the amount, the memo, and a person executes at the bank and returns the reference through the execution verb. Programmatic initiation through Mercury's API is named as a later option that would require its own justification and its own stop card, because the day the system can move money is a different day, and it should be chosen out loud or not at all.

Xero, the book beside. The journal reference completes each movement's three-way pairing, and the relationship runs both directions: the treasury supplies the book with clean, referenced movement facts, and the book supplies PP's allocation step 02, the finalized P&L, whose allocation.pnl_finalized payload carries the Xero close reference so the year's most consequential number cites its source like everything else.¹

Reconciliation is the module's conscience, and it is a tally, not a chore: over a Reconciliation Window, every money-referencing CIS event must pair with a bank line, every bank line in scope must pair with a CIS event, and the journal must agree with both. The treasurer attests the window with treasury.reconciled, whose payload counts the matches and names every gap: the movement with no bank line, the bank line with no movement, the pair with no journal. A named gap is a card on the desk until treasury.gap_resolved closes it with its explanation, a late pairing, a correction event on whichever side mis-recorded, or, in the worst case, the visible evidence of a movement made outside the discipline. Gaps do not expire, cannot be attested over, and the next window will not close while unexplained ones stand. This is the mechanism that makes the §6 honest-limits box tolerable: the record cannot prevent everything, but it can refuse to pretend.

Browse. The Desk at /intranet/treasury/, beside the Programs view in the commons portal: the proposal queue with each item's accumulated trail, the execution list awaiting bank references, the reconciliation state with its gap cards, and the instrument in force with its thresholds visible. For members, no new surface is needed for their own facts: a member's dues receipts, share purchase, and distribution events already concern them, so the standing events policy shows them on their own account and history surfaces, movement lines beside meaning lines.⁴ The aggregate picture, how the cooperative's money stands, belongs to the open benefit report of the v2 narrative's horizon, under Principle 07, and this module supplies its treasury half now, as the balance view below, ahead of that page.

Balance. Beside the desk sits a balance view, the rail-reported picture: what each custodian says the cooperative holds right now, read live and read only. Stripe reports its available and pending balance, the funds captured and awaiting payout; Mercury reports the operating balance of each account it holds; Xero reports the book's cash position, the figure the accounting record carries.⁶ Each number arrives by the same seam discipline the intake uses, an edge function holding that rail's read-only credential and returning the figure with the timestamp of its read, reference not value, so a stale read says it is stale rather than pretending to be current. A balance is neither a movement nor a meaning, so nothing here is written to the log: it is an outside observation held beside the record, not a fact inside it, and the two-layer principle stays intact.

The point of showing it is honesty, not accounting. The record keeps its own number, the sum the events reconcile to, and the balance view sets the rail's number beside the record's for each rail, with the delta between them and, once the tally runs, a link to the gap card any unexplained difference opens. Agreement is the ordinary case and shows plainly; a standing delta is the reconciliation conscience made visible on the surface where anyone with the door can see it. This is the treasury half of the aggregate picture the open benefit report will carry under Principle 07, brought forward as soon as the reads exist rather than held for that page: the balance view needs no write rail, so the Stripe and Mercury reads and the Xero position can stand at R1 beside the read-only desk, and the delta column activates at R3 when the tally begins to attest. Which cut is shown to whom, the member-visible aggregate and agreement indicator that open books invite against the per-rail figures and deltas the desk audience holds, is a visibility question routed below, not decided here.

Ask answers over the identical record. Verify inherits everything: the events export already carries every kind here, the walkaway already reconstructs, and the weekly rehearsal will simply start exercising treasury rows the day they exist.³

The balance view answers the first question a member brings to the money: what do we hold. An organizer's question, recorded 2026-08-03 and quoted here because it is exactly the shape of the need, asked for the rest: updated financials for the next family or LCA meeting, our cash flow, our balance sheet, who needs to pay and how much is outstanding. The statements view is this module's answer, the primary member-facing reading of the cooperative's finances by month, quarter, and fiscal year, derived entirely from what the record already holds, and cut so that open books and member privacy stop being a trade and become a design.

No number on this surface is entered; every figure is a tally. Three sources and no others: the record, the money.received, disbursement, capital, and share kinds this module and PP already write; the instruments in force, the dues schedule and membership terms whose adopted payloads price what each member is expected to pay; and the reads, the §9 rail balances and a Xero summary arriving by the same seam discipline, source and read time attached, reference not value. A figure that cannot cite one of the three does not appear. This is Law IV applied to accounting: follow any figure on the page to its events, its instrument, or its read.

The month is the atomic tally; quarters and the fiscal year are sums of months, never separate computations that could disagree. This document assumes the calendar year as the fiscal year until the board records otherwise, and the surface says so. A month is closed when a §8 Reconciliation Window covering it stands attested, and provisional until then, wearing the mark either way: the soft-close and hard-close convention of ordinary accounting practice, mapped onto the attestation the tally already defines rather than invented beside it. The statements the CIS derives are cash-basis, because the record is a record of movements; the accrual statements remain Xero's, cited beside the record's figures by reference and never restated, so the book of account keeps its own authority and the two bases can be compared instead of confused.

The cuts are the section's heart, because the request that occasioned it names both halves: co-op knowledge of organizational performance, and member privacy. Three cuts. The member cut, for every patron member: the whole aggregate picture, position, flow, the ribbon, and standing as counts and totals, no names and no per-member amounts, beside the member's own line in full, which was already theirs to see. One rule guards the seam between aggregate and identity: when fewer than three members stand outstanding, the member cut shows the count and withholds the total, because a total over one or two is a name wearing arithmetic. The desk cut, for the directors and officers 0002 already seats at the Desk: the named roster, each member's expected, received, outstanding, and age. The public cut: deferred to the open benefit report under Principle 07, and nothing here decides it.

One consequence of the standing policies decides the architecture. Under 0002 a member reads their own events and the desk audience reads all of them, which is right, and which means the member cut cannot be computed in the browser from rows the browser is rightly refused. So the aggregate crosses the boundary as a tally, never as rows: a small yield, 000N_treasury_folds.sql, anticipated, defines definer functions, the position, the flow by month, the standing aggregate, each returning totals and counts only, each carrying the as-of instant of its read, granted to members exactly as wide as the member cut and no wider. The desk cut needs no such help; it tallies the rows it already reads, as the Desk does today. The rls probes gain the matching assertion: the member-facing tallies return no name, no member id, and no per-member amount. Nothing writes to the log; the tally path holds no state; the same tally over the same events returns the same figures tomorrow, which is what makes a statement a statement rather than a screenshot.

The view stands at R1 over existing facts, beside the Desk on the same door: flow from whatever movements the record holds, member capital from the PP tally, the ribbon honest that no window has attested. Standing activates when the dues schedule records as an instrument, the same condition R2's intake pricing already waits on; the closed marks activate as T-03 begins to attest; the accrual column activates when the Xero summary read is provisioned under the §14 credentials item. Each region, until its condition arrives, names the yield that fills it rather than pretending, in the Desk's own convention.

One store stands beside the tallies, staged 2026-08-05 on the steward's direction ahead of the record's own events: treasury_statements (0019), dated rail-derived monthly snapshots written only by the read-only runner at scripts/treasury_statements.py through the management channel, readable at the member cut, each wearing provisional until a §8 window attests its month. It holds observations, never events, which is exactly the standing the §9 balance reads already have: the rails as read, at a time, beside the record and not inside it. When T-02 and T-03 arrive, the record's tallies take the flow and close columns over, and the snapshots remain what they were, the first statements the members could actually read.

The two modules share one log, one configuration convention, one verb discipline, and one export duty; their joint is four specific contracts. The discharge contract: every PP capital.distribution commitment is discharged only by a disbursement whose trail is complete, and G-S's hand-check gains a treasury clause in §12. The contribution contract: a CASH Primitive credit under PP requires a paired money.received, so no cash capital exists in meaning that never existed in movement. The buy-in contract: a share purchase runs front door to tally, movement, issuance, credit, and the labor-equivalent path from the February design runs the same last step from PP's HOURS machinery instead of from Stripe, two roads into one register. The close contract: step 02 of every Allocation Run cites the Xero close through this module's pairing, so the patronage year and the accounting year cannot silently diverge. Where PP is adopted and this module is not yet, nothing breaks: commitments simply remain anticipated, visibly, which is the boundary PP already drew.

The order encodes the v2 narrative's sequencing argument: intake and reconciliation make everything later trustworthy, and execution, the only phase that moves money, arrives last, into a fabric already proven to reconcile.

1. A replayed intake webhook writes exactly one money.received; the idempotency probe asserts it.
2. A disbursement short of its threshold, or with proposer and approver the same person, refuses, and the refusal cites the policy version and the rule.
3. A PP commitment shows as settled only when its executed disbursement and reconciliation match both exist; unpair either and the surface honestly reverts.
4. An injected synthetic gap, a bank line with no movement, surfaces as a named card, blocks the window's attestation, and clears only through treasury.gap_resolved.
5. Every figure on the Desk and on a member's movement lines resolves to its events, its instrument, and its rail reference; the Law IV walk finds no unexplained boundary.
6. The share register conserves: issuance and redemption events match the stock_ledger exactly, and one voting share per member holds under load.
7. The walkaway continues byte-identical with treasury kinds present, demonstrated by the weekly harness without being asked.
8. Each balance on the view carries the source and the timestamp of its read; a read past its freshness threshold renders as stale, not as current, and the probe asserts it.
9. The balance view's aggregate equals the sum of its per-rail reads with no hidden derivation, and each per-rail delta equals the rail-reported figure minus the reconciled record.
10. Every figure on the statements view resolves to its events, its instrument, or its read, with basis and as-of visible; each quarter and the year equal the sum of their months, asserted, not assumed.
11. The member cut, probed as a member, returns no other member's name, id, or per-member amount, and withholds the standing total when fewer than three members stand outstanding.
12. Outstanding equals instrument-expected minus received, hand-computable from the events and the instrument in force; a month wears closed only when an attested window covers it.

The proof sentence proposed for G-T, in the house grammar: a movement shown settled equals a movement traced by hand, proposal to approvals to bank line to journal, and the window attests with nothing unexplained.

PRD v0.4 left treasury's pieces to sequence in the Almanac after the launch capabilities, under a capability name to be settled there. This proposal offered the bed and floated two public-name candidates, Hold in trust and See it move; neither was taken. The bed merged 2026-07-22 under the ledger address TREASURY, and the deployed map (U-03) settled the public name as plain Treasury, with The Desk as its door. amended 2026-07-27 · naming settled by the record

# proposed graft · the treasury bed · adoption is the merge, and the merge is Todd's
- address: T-01
  title: The Desk and the policy instrument
  intent: /intranet/treasury/ read-only over existing facts; TREASURY-POLICY v1 in force per TR §6.
  status: anticipated
  cites: [TR, PP, AM, IM]
  ready_when: TR adopted. TREASURY-POLICY adopted.
  acceptance: The thresholds in force are visible on the Desk, cited to their instrument.

- address: T-02
  title: The intake rail
  intent: Stripe to money.received by the 0006 seam pattern, dues then share purchase, per TR §7.
  status: anticipated
  cites: [TR, PP, AM]
  ready_when: T-01 verified. Dues schedule and membership terms recorded as instruments.
  acceptance: A replayed webhook writes once; a purchase prices only from the instrument in force.

- address: T-03
  title: The reconciliation tally
  intent: Three-way pairing across ledger, bank, and book; windows attest; gaps card, per TR §8.
  status: anticipated
  cites: [TR, IM, VS]
  ready_when: T-02 verified. Mercury feed and Xero references flowing.
  acceptance: First window attested; an injected gap blocks attestation until resolved.

- address: T-04
  title: Disbursement execution
  intent: PP commitments discharged, proposal to approvals to bank reference, per TR §5 and §10.
  status: anticipated
  cites: [TR, PP, AM]
  ready_when: T-03 verified. S-03 recorded under PP.
  acceptance: A commitment settles by pairing and the hand-trace matches.

- address: T-05
  title: The redemption path
  intent: share.redeemed and its payout, per the membership lifecycle already in the substrate.
  status: open · redeemability
  cites: [TR, PP, AM]
  ready_when: The redeemability question resolved by board and counsel.
  acceptance: A redemption runs register to bank with the full trail, or refuses citing the open question.

- address: T-06
  title: The balance view
  intent: /intranet/treasury/ shows each rail's reported holding, Stripe, Mercury, Xero, read only with its source and read time; the delta to the reconciled record beside it, per TR §9.
  status: anticipated
  cites: [TR, IM, VS]
  ready_when: T-01 verified. Read-only credentials provisioned for the three rails.
  acceptance: Each rail's balance shows with its source and read time; the member-visible aggregate equals the sum of the reads; after T-03 the delta to the last attested window shows and links its gaps.

- address: T-07  # grafted 2026-08-03, per §9a
  title: The statements view
  intent: /intranet/treasury/ shows position, flow, standing, and the close ribbon by month, quarter, and fiscal year, derived from the record and cut per audience, per TR §9a.
  status: anticipated
  cites: [TR, PP, IM, AM, VS]
  ready_when: T-01 verified. The dues schedule recorded as an instrument; the member-cut tallies yielded.
  acceptance: Every figure resolves to its events, instrument, or read; the member cut names no other member under probe; outstanding equals instrument-expected minus received by hand; closed only under an attested window.

- address: G-T
  title: Treasury proof
  ready_when: T-04 verified.
  proof: Human attestation recorded.
  acceptance: A movement shown settled equals a movement traced by hand; the window attests with nothing unexplained.

Nothing here is legal or tax advice; it is research shaped for the people who give that advice, in the standing division of labor.

This document proposes a shape and nothing more. It does not adopt a threshold, fix the buy-in figure, or answer redeemability. It does not connect a webhook, hold a key, or move a dollar; the day the system could initiate a payment is explicitly deferred to a proposal that does not yet exist. It does not merge its own graft, and it does not adopt itself. It is the second half of a pair: Program Patronage says what money means here, and this module says how money moves here, and both remain proposals until the people they serve, the board, the FSC, counsel, the members, and Todd, have had the argument each section was drawn plainly enough to invite.